TGQR 2010Q4 Report.pdf - Teragridforum.org

8.7 Security
8.7.1
Security Working Group
A new proposal to support MPC on the portal was reviewed by the Security Working Group. The
new design removes MCP from the portal and moves it to Teragrid resources. One concern was
the protection of the proxy credential while in transit between the portal and the resource. The
group recommended that the portal should delegate this to GRAM vs. GridFTP.
Securing Community Accounts Survey: Victor Hazlewood reviewed the results of a survey sent
to RP security leads in early November. Although not all results have been received, he felt there
was enough information to share with the working group. Nancy began the discussion stating the
goal for this excerise is to have a more uniform development experience across RPs for Science
Gateways building off the information gathered at the "Security Summit" of 2008. The results of
the survey and suggested policy recommendations for RPs is in draft status and available upon
request.
The security team spent a siginificant amout of time responding to serious Linux vulnerabilities.
At on point we were averaging, one per week and when announced, there were no vendor patches
available to mitigate the risk. This created an akward sitiuation where RPs had to find ways to
protect against these threats until patches were forthcoming. For each of these vulnerabilities, the
Security Working Group created a wiki page so the vulnerability status of all RPs could be
tracked. This included identifying which of the production systems were at risk, what controls
could be applied to mitigate the risks until an official patch was released.
During the time of this report there were approximately 11 compromised user accounts and one
login node compromise.
The annual TeraGrid assessment project was completed and accepted during this quarter. This
year’s effort focused on an assessment of the TeraGrid User portal (TGUP) operations and
technologies. The TeraGrid user portal has become and increasingly important piece of the
TeraGrid infrastructure including a common place for many TeraGrid users to get live
information as well as pointers to static information on the portal, POPS, or other TeraGrid
maintained web presences. In addition, a username password login into the TGUP can also be
used to generate short term proxied credentials that can be used for access to TeraGrid resources
central or at the RP’s including queried of properly authorized user records on the TGCDB,
orchestrating file transfers on the TeraGrid and even command line access to TeraGrid sites. The
assessment found that TeraGrid staff were well aware of and taking measures to prevent common
web-based application vulnerabilities. In addition, the TGUP has defined and handled issues of
properly handling and proxying user credentials while accessing the portal. However, the
assessment did identify issues, in addition to these, that warranted further vigilance including
additional requirements for third party (i.e. no TeraGrid RP) hosted systems. During this quarter,
previous drafts were reviewed and discussed in several forums including the security working and
appropriate modifications were made.
8.7.2
Expanded TeraGrid Access
An update of the GSI-SSHTerm software to use the latest jGlobus 2.0 and BouncyCastle TLS
libraries was completed. GSI-SSHTerm is one of the most popular applications in the TGUP, but
the currently deployed version relies on out-of-date security libraries that do not support current
recommended security algorithms such as SHA-256. In Q1 2011 we will be testing this new GSI-
SSHTerm version for production roll-out in the TGUP. Jim Basney assisted the TGUP team with
the necessary Kerberos integration to support the new Vetted/Unvetted account management
process, and also contributed to the TGUP team with InCommon/Shibboleth testing in
preparation for rolling out the production InCommon login capability in the TGUP.
83